RewindexCVEs
CVEs
5,626 vulnerabilities, 1,758 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-4270 AWS API MCP File Access Restriction Bypass
CVSS 5.5 mediumEPSS 0.13%Amazon Web Services
CVE-2026-24692 Guest users can bypass read permissions via search API
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-22545 Password Change Bypass via Auth Switch Endpoint
CVSS 3.1 lowEPSS 0.15%Mattermost
CVE-2026-2455 SSRF bypass via IPv4-mapped IPv6 literals
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-21386 Private channel enumeration via /mute slash command
CVSS 4.3 mediumEPSS 0.19%Mattermost
CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload
CVSS 4.3 mediumEPSS 0.28%Mattermost
CVE-2026-4265 Guest user can upload files without permission across teams
CVSS 4.3 mediumEPSS 0.23%Mattermost
CVE-2026-25783 Denial of service via malformed User-Agent header in getBrowserVersion
CVSS 4.3 mediumEPSS 0.30%Mattermost
CVE-2026-24458 DoS attack via login attempts with multi-megabyte passwords
CVSS 7.5 highEPSS 0.28%Mattermost
CVE-2026-2462 Admin RCE via Malicious Plugin Upload on CI Test Instances
CVSS 6.6 mediumEPSS 0.34%Mattermost
CVE-2026-26246 Memory Exhaustion via Malformed PSD File Upload
CVSS 4.3 mediumEPSS 0.22%Mattermost
CVE-2026-2458 Unauthorized channel enumeration in private teams after member removal
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation
CVSS 4.3 mediumEPSS 0.11%Mattermost
CVE-2026-2463 Unauthorized access to invite ID during team creation
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions
CVSS 5.3 mediumEPSS 0.17%Mattermost
CVE-2025-47813 Wing FTP Server Information Disclosure Vulnerability
CVSS 4.3 mediumKEV added EPSS 62.5%
CVE-2026-26133 M365 Copilot Information Disclosure Vulnerability
CVSS 7.1 highEPSS 0.44%Microsoft TeamsPower BI
CVE-2026-32621 Apollo Federation has prototype pollution via incomplete key sanitization
CVSS 9.9 criticalEPSS 0.53%Apollo GraphQL
CVE-2026-3910 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
CVSS 8.8 highKEV added EPSS 2.7%
CVE-2026-3909 Google Skia Out-of-Bounds Write Vulnerability
CVSS 8.8 highKEV added EPSS 2.3%
CVE-2026-1182 Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
CVSS 4.3 mediumEPSS 0.20%GitLab
CVE-2026-31813 Supabase Auth has insecure Apple and Azure authentication with ID tokens
CVSS 4.8 mediumEPSS 0.14%Supabase
CVE-2026-20162 Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise
CVSS 6.3 mediumEPSS 0.21%Splunk
CVE-2026-20165 Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise
CVSS 6.3 mediumEPSS 0.17%Splunk
CVE-2025-12555 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.25%GitLab
CVE-2025-12576 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.40%GitLab
CVE-2025-12697 Improper Encoding or Escaping of Output in GitLab
CVSS 2.2 lowEPSS 0.30%GitLab
CVE-2025-12704 Missing Authorization in GitLab
CVSS 3.5 lowEPSS 0.26%GitLab
CVE-2025-13690 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.40%GitLab
CVE-2025-13929 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.53%GitLab
CVE-2025-14513 Improper Validation of Specified Quantity in Input in GitLab
CVSS 7.5 highEPSS 0.49%GitLab
CVE-2026-0602 Authentication Bypass Using an Alternate Path or Channel in GitLab
CVSS 4.3 mediumEPSS 0.25%GitLab
CVE-2026-1069 Uncontrolled Recursion in GitLab
CVSS 7.5 highEPSS 0.41%GitLab
CVE-2026-1230 Use of Incorrectly-Resolved Name or Reference in GitLab
CVSS 4.1 mediumEPSS 0.20%GitLab
CVE-2026-1663 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.24%GitLab
CVE-2026-1732 Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
CVSS 4.3 mediumEPSS 0.26%GitLab
CVE-2026-3848 Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab
CVSS 5.0 mediumEPSS 0.19%GitLab
CVSS 9.6 criticalEPSS 0.33%Zoom
CVE-2026-30902 Zoom Clients for Windows - Improper Privilege Management
CVSS 7.8 highEPSS 0.12%Zoom
CVE-2026-30901 Zoom Rooms for Windows - Improper Input Validation
CVSS 7.0 highEPSS 0.12%Zoom
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)